customclaim

package
v0.0.11 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 18, 2026 License: Apache-2.0, MIT Imports: 19 Imported by: 0

Documentation

Overview

Package customclaim manages per-user and per-group key/value claims injected into OIDC tokens. The federation oidc package consumes them at token time via a consumer-side adapter.

Index

Constants

This section is empty.

Variables

View Source
var (
	ErrNotFound  = errors.New("custom claim not found")
	ErrDuplicate = errors.New("custom claim already exists for this owner")
)

Errors surfaced by the store; the handler maps them to statuses.

Functions

This section is empty.

Types

type CustomClaim

type CustomClaim struct {
	ID    CustomClaimID `json:"id"`
	Key   string        `json:"key"`
	Value string        `json:"value"`

	UserID      *string `json:"user_id,omitzero"`
	UserGroupID *string `json:"user_group_id,omitzero"`

	CreatedAt time.Time `json:"created_at"`
}

CustomClaim is one key/value claim attached to a user or a group (exactly one owner, enforced by the database CHECK). Keys are case-sensitive; uniqueness is (key, user, group) — Postgres treats NULLs as distinct in the UNIQUE constraint, so the service checks duplicates up front.

type CustomClaimID

type CustomClaimID = typeid.TypeID[customClaimPrefix]

Typed IDs for the custom claim tables: UUIDv7 suffix, snake_case prefix matching the singular table name.

type PostgresStore

type PostgresStore struct {
	// contains filtered or unexported fields
}

PostgresStore persists claims in public.custom_claims. It keeps the parent Store for WithTx (list-replace runs in a transaction).

func NewPostgresStore

func NewPostgresStore(store datastore.Store) *PostgresStore

NewPostgresStore builds the production claim store.

func (*PostgresStore) Create

func (s *PostgresStore) Create(ctx context.Context, params UpsertParams) (CustomClaim, error)

Create inserts one claim; uuidv7() fills the ID.

func (*PostgresStore) Delete

func (s *PostgresStore) Delete(ctx context.Context, id CustomClaimID) error

Delete removes one claim.

func (*PostgresStore) ExistsForOwner

func (s *PostgresStore) ExistsForOwner(ctx context.Context, params UpsertParams) (bool, error)

ExistsForOwner reports whether the (key, owner) pair is present.

func (*PostgresStore) ListByGroup

func (s *PostgresStore) ListByGroup(ctx context.Context, groupID usergroup.UserGroupID) ([]CustomClaim, error)

ListByGroup returns one group's claims.

func (*PostgresStore) ListByUser

func (s *PostgresStore) ListByUser(ctx context.Context, userID user.UserID) ([]CustomClaim, error)

ListByUser returns one user's claims, by key then value.

func (*PostgresStore) ReplaceForGroup

func (s *PostgresStore) ReplaceForGroup(ctx context.Context, groupID usergroup.UserGroupID, params []UpsertParams) ([]CustomClaim, error)

ReplaceForGroup swaps a group's whole claim set atomically.

func (*PostgresStore) ReplaceForUser

func (s *PostgresStore) ReplaceForUser(ctx context.Context, userID user.UserID, params []UpsertParams) ([]CustomClaim, error)

ReplaceForUser swaps a user's whole claim set atomically.

func (*PostgresStore) SuggestedKeys

func (s *PostgresStore) SuggestedKeys(ctx context.Context) ([]string, error)

SuggestedKeys lists distinct claim keys, most used first — upstream orders the suggestions by usage count.

func (*PostgresStore) Update

func (s *PostgresStore) Update(ctx context.Context, id CustomClaimID, value string) (CustomClaim, error)

Update replaces the value of one claim.

type Service

type Service struct {
	// contains filtered or unexported fields
}

Service holds the claim business rules and HTTP surface.

func NewService

func NewService(store Store, recorder identity.Recorder, opts ...ServiceOption) *Service

NewService builds the claim feature on the given store.

func (*Service) APIRoutes

func (s *Service) APIRoutes(r chi.Router, g identity.RouteGroups)

APIRoutes mounts the claim endpoints inside the shared /api group, behind the admin group when one is wired.

func (*Service) CreateForGroup

func (s *Service) CreateForGroup(ctx context.Context, groupID usergroup.UserGroupID, params UpsertParams) (CustomClaim, error)

CreateForGroup attaches a claim to one group.

func (*Service) CreateForUser

func (s *Service) CreateForUser(ctx context.Context, userID user.UserID, params UpsertParams) (CustomClaim, error)

CreateForUser attaches a claim to one user.

func (*Service) Delete

func (s *Service) Delete(ctx context.Context, id CustomClaimID) error

Delete removes one claim.

func (*Service) ListByGroup

func (s *Service) ListByGroup(ctx context.Context, groupID usergroup.UserGroupID) ([]CustomClaim, error)

ListByGroup returns one group's claims.

func (*Service) ListByUser

func (s *Service) ListByUser(ctx context.Context, userID user.UserID) ([]CustomClaim, error)

ListByUser returns one user's claims.

func (*Service) Name

func (s *Service) Name() string

Name names the feature for logs.

func (*Service) ReplaceForGroup

func (s *Service) ReplaceForGroup(ctx context.Context, groupID usergroup.UserGroupID, params []UpsertParams) ([]CustomClaim, error)

ReplaceForGroup swaps a group's whole claim set.

func (*Service) ReplaceForUser

func (s *Service) ReplaceForUser(ctx context.Context, userID user.UserID, params []UpsertParams) ([]CustomClaim, error)

ReplaceForUser swaps a user's whole claim set. Owner scoping is applied to every item; duplicate keys inside one call are rejected before touching the database.

func (*Service) SuggestedKeys

func (s *Service) SuggestedKeys(ctx context.Context) ([]string, error)

SuggestedKeys lists distinct claim keys already in use.

func (*Service) UpdateValue

func (s *Service) UpdateValue(ctx context.Context, id CustomClaimID, value string) (CustomClaim, error)

UpdateValue replaces one claim's value.

type ServiceOption

type ServiceOption func(*Service)

ServiceOption configures the claim feature.

type Store

type Store interface {
	Create(ctx context.Context, params UpsertParams) (CustomClaim, error)
	ExistsForOwner(ctx context.Context, params UpsertParams) (bool, error)
	Update(ctx context.Context, id CustomClaimID, value string) (CustomClaim, error)
	Delete(ctx context.Context, id CustomClaimID) error
	ListByUser(ctx context.Context, userID user.UserID) ([]CustomClaim, error)
	ListByGroup(ctx context.Context, groupID usergroup.UserGroupID) ([]CustomClaim, error)
	// ReplaceForOwner swaps the whole claim set for the owner in one
	// transaction.
	ReplaceForUser(ctx context.Context, userID user.UserID, params []UpsertParams) ([]CustomClaim, error)
	ReplaceForGroup(ctx context.Context, groupID usergroup.UserGroupID, params []UpsertParams) ([]CustomClaim, error)
	SuggestedKeys(ctx context.Context) ([]string, error)
}

Store persists custom claims scoped to users or groups.

type UpsertParams

type UpsertParams struct {
	Key         string
	Value       string
	UserID      *string
	UserGroupID *string
}

UpsertParams carries the claim fields for one owner scope.

func (*UpsertParams) Validate

func (p *UpsertParams) Validate() error

Validate normalizes and enforces the claim shape.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL